watercrazed
Topic Starter
Hi,
I have been working on this for a couple a days on my own and made some progress but have some continuing problems.
1. System boots to windows, enter user account and encounter a Visual Studio JIT debugger screen with an unhandled win32 exception in explorer [2748] -> select no -> desktop loads -> any click and a blue screen -> task manager
-> run explorer - opens explorer window
Sometimes the desktop is stable and the wireless network and dsl connection loads
2. I am having reoccurring memory exceptions in smss.exe usually the same memory location. Task Manager shows 2 smss.exe processes running one is using 2,624K and the other is using 392K of memory.
and two lsass.exe processes. The reoccurring application error in smss.exe instruction at 0x7c901010 referring memory at 0x00875a4 in a message window. The location is usually the same one.
This opens a dialog for visual studio asking if I want to debug it, I generally click NO but if yes the debugger opens and hangs.
after closing the exception message, sometimes several times, the the user settings will load.
3. I tried to boot in safe mode, all three types and drivers would load and then it would go back to the safe mode selection screen, but I can select boot from windows normally and it will boot up windows.
So I DO NOT have access to Safe Mode
I have the paid version of AVG internet security but the command center will not load, the outline of the program shows then it hangs, I tried to reinstall it and it failed with a program exception error. win32 exception in avgxxxxx.exe install - I do see the avg processes running in task manager
Tried uninstall and it hung, phyiscally deleted the files 2 left. Also tried to install trial version it would not install
Downloaded Hijackthis and renamed it Ran it, it worked but
started with an error
Error details - an unexpected error has occurred at procedure: ModMain_CheckOther1Item() Error#70 permission denied
COULD NOT save the log file - saved a 0k file.
Hijack log showed a number of suppected problems
alot of 04-Global startup ~.exe.188187.exe with differing 6 digit numbers, generating popups.
other entries of concern
02 BHO : (no name) [xxx-xxxx-xxxx-xxx } (no file)
08 &AOLSearch bar not used
020 AppInit_Dlls: C:/windows/system32/dnsq.dll
023: KService-unknown owner C:/program files/Kontiki/KService.exe
023: -Service: PrismXL - New Boundary Tech. Inc c:\Program Files\common files\New Boundray\PrismXL\PrismXL.sys
023: - Service: PsExec (PSEXESVC) Sysinternals C:\window\PSEXESVC.exe
Ad aware caught this but seems like a left over.
There is also a variety of AGV7 and Kaspersky and symantec w files or (file missing)
Check fix on
~.exe188187.exe
02: BHO : (no name) [xxxxxxx-xxxx-xxxxx] (no file)
SSD -
First time through
Virtumundo -
Smithfraud-C-generic
showed a lot of Mircosoft.windows.RedirectedHosts. [###]
Second time through
No virus detected
There are about 20 Microsoft.windows.redirectedHosts. [xx]
Ad aware
Trojan - Psexesvc
win32.trojan.agent
Virtumundo
I ran smithfraudfix, VirtumundoBegone, and Vendofix
Logs available on VBG and SmithFraud, No Vuno files found
Task manager showing 15 to 20 nircmd.exe processes when iexplore has loaded and having popups from CN domains - related to pop ups?
Combofix - opens a blue box with a black c in the header and nothing else happens and DSS would not load - DSS started to load - registering then stalled - brought up the Highjack this error
Downloaded and tried to run DSS - Got through registering hives and stalled at running highjackthis clone
Ran Panda - no files found
I found http://www.eset.eu with online anti virus that would run
found 177 infected files - Results / log would not save tried to email it to another computer/account did not work
Tried to Run Housecall again would not get through the greyware scan it did find - this before it locked up TROJ_PAGIPEF.AU
Tried to Run Kaspersky full system scan - 6 hours into it I went to bed, System was locked up when I got up
Downloaded and renamed highjackthis
COULD NOT run in SAFEMODE ran in normal - Could not save log. it saved a 0 byte file and locked up.
~.exe188187.exe - all variations gone
02 BHO : (no name) [xxx-xxxx-xxxx-xxx } (no file) - gone
08 &AOLSearch bar not used
020 AppInit_Dlls: C:/windows/system32/dnsq.dll - moved to Kaspersky subdirectory, now not shown in highjackthis
023: KService-unknown owner C:/program files/Kontiki/KService.exe - gone shows up in Services - disabled
023: -Service: PrismXL - New Boundary Tech. Inc c:\Program Files\common files\New Boundray\PrismXL\PrismXL.sys - I manually Stopped and disabled in Admin Services
023: - Service: PsExec (PSEXESVC) Sysinternals C:\window\PSEXESVC.exe - Gone
Still No safe mode, explorer errors, two smss.exe and lsass.exe processes, desktop not stable, Popups still in iexplore.
Any ideas about how to approach this?
Just ran Kaspersky quick scan here is the log.
Hijackthis shows this again
020 AppInit_Dlls: C:/windows/system32/dnsq.dll
Explorer does not show it in that directory it is in kaspersky subdirectory I deleted it
I found the eset log from earlier and have attached it
still showing lots maybe 100
in SS&D Microsoft.windows.redirectedHosts. [xx]
Added recent ad aware log
I have been working on this for a couple a days on my own and made some progress but have some continuing problems.
1. System boots to windows, enter user account and encounter a Visual Studio JIT debugger screen with an unhandled win32 exception in explorer [2748] -> select no -> desktop loads -> any click and a blue screen -> task manager
-> run explorer - opens explorer window
Sometimes the desktop is stable and the wireless network and dsl connection loads
2. I am having reoccurring memory exceptions in smss.exe usually the same memory location. Task Manager shows 2 smss.exe processes running one is using 2,624K and the other is using 392K of memory.
and two lsass.exe processes. The reoccurring application error in smss.exe instruction at 0x7c901010 referring memory at 0x00875a4 in a message window. The location is usually the same one.
This opens a dialog for visual studio asking if I want to debug it, I generally click NO but if yes the debugger opens and hangs.
after closing the exception message, sometimes several times, the the user settings will load.
3. I tried to boot in safe mode, all three types and drivers would load and then it would go back to the safe mode selection screen, but I can select boot from windows normally and it will boot up windows.
So I DO NOT have access to Safe Mode
I have the paid version of AVG internet security but the command center will not load, the outline of the program shows then it hangs, I tried to reinstall it and it failed with a program exception error. win32 exception in avgxxxxx.exe install - I do see the avg processes running in task manager
Tried uninstall and it hung, phyiscally deleted the files 2 left. Also tried to install trial version it would not install
Downloaded Hijackthis and renamed it Ran it, it worked but
started with an error
Error details - an unexpected error has occurred at procedure: ModMain_CheckOther1Item() Error#70 permission denied
COULD NOT save the log file - saved a 0k file.
Hijack log showed a number of suppected problems
alot of 04-Global startup ~.exe.188187.exe with differing 6 digit numbers, generating popups.
other entries of concern
02 BHO : (no name) [xxx-xxxx-xxxx-xxx } (no file)
08 &AOLSearch bar not used
020 AppInit_Dlls: C:/windows/system32/dnsq.dll
023: KService-unknown owner C:/program files/Kontiki/KService.exe
023: -Service: PrismXL - New Boundary Tech. Inc c:\Program Files\common files\New Boundray\PrismXL\PrismXL.sys
023: - Service: PsExec (PSEXESVC) Sysinternals C:\window\PSEXESVC.exe
Ad aware caught this but seems like a left over.
There is also a variety of AGV7 and Kaspersky and symantec w files or (file missing)
Check fix on
~.exe188187.exe
02: BHO : (no name) [xxxxxxx-xxxx-xxxxx] (no file)
SSD -
First time through
Virtumundo -
Smithfraud-C-generic
showed a lot of Mircosoft.windows.RedirectedHosts. [###]
Second time through
No virus detected
There are about 20 Microsoft.windows.redirectedHosts. [xx]
Ad aware
Trojan - Psexesvc
win32.trojan.agent
Virtumundo
I ran smithfraudfix, VirtumundoBegone, and Vendofix
Logs available on VBG and SmithFraud, No Vuno files found
Task manager showing 15 to 20 nircmd.exe processes when iexplore has loaded and having popups from CN domains - related to pop ups?
Combofix - opens a blue box with a black c in the header and nothing else happens and DSS would not load - DSS started to load - registering then stalled - brought up the Highjack this error
Downloaded and tried to run DSS - Got through registering hives and stalled at running highjackthis clone
Ran Panda - no files found
I found http://www.eset.eu with online anti virus that would run
found 177 infected files - Results / log would not save tried to email it to another computer/account did not work
Tried to Run Housecall again would not get through the greyware scan it did find - this before it locked up TROJ_PAGIPEF.AU
Tried to Run Kaspersky full system scan - 6 hours into it I went to bed, System was locked up when I got up
Downloaded and renamed highjackthis
COULD NOT run in SAFEMODE ran in normal - Could not save log. it saved a 0 byte file and locked up.
~.exe188187.exe - all variations gone
02 BHO : (no name) [xxx-xxxx-xxxx-xxx } (no file) - gone
08 &AOLSearch bar not used
020 AppInit_Dlls: C:/windows/system32/dnsq.dll - moved to Kaspersky subdirectory, now not shown in highjackthis
023: KService-unknown owner C:/program files/Kontiki/KService.exe - gone shows up in Services - disabled
023: -Service: PrismXL - New Boundary Tech. Inc c:\Program Files\common files\New Boundray\PrismXL\PrismXL.sys - I manually Stopped and disabled in Admin Services
023: - Service: PsExec (PSEXESVC) Sysinternals C:\window\PSEXESVC.exe - Gone
Still No safe mode, explorer errors, two smss.exe and lsass.exe processes, desktop not stable, Popups still in iexplore.
Any ideas about how to approach this?
Just ran Kaspersky quick scan here is the log.
Hijackthis shows this again
020 AppInit_Dlls: C:/windows/system32/dnsq.dll
Explorer does not show it in that directory it is in kaspersky subdirectory I deleted it
I found the eset log from earlier and have attached it
still showing lots maybe 100
in SS&D Microsoft.windows.redirectedHosts. [xx]
Added recent ad aware log
